English for Compliance: Essential Vocabulary & Phrases

"regulatory framework"

The complete set of laws, regulations, guidelines, and standards that govern the conduct of an organisation or industry

"The compliance team mapped every control to the applicable regulatory framework before the external audit."

"supervisory authority"

A government or independent body empowered to oversee, inspect, and enforce compliance with regulations in a specific sector

"The supervisory authority issued a formal notice requiring the bank to remediate its AML controls within 90 days."

"binding obligation"

A legal requirement that an organisation must fulfil, as opposed to a voluntary guideline or best practice

"GDPR creates binding obligations for every company processing the personal data of EU residents, regardless of where the company is based."

"regulatory perimeter"

The boundary that defines which entities or activities fall under the jurisdiction of a particular regulator

"The fintech startup sought legal advice to determine whether its new product fell within the regulatory perimeter of the FCA."

"proportionality principle"

The concept that compliance requirements should be proportionate to the size, complexity, and risk profile of the organisation

"The regulator applied the proportionality principle, setting lighter reporting requirements for community banks than for global systemically important institutions."

"extraterritorial effect"

The application of a country's law or regulation to conduct that takes place outside that country's borders

"The US Foreign Corrupt Practices Act has extraterritorial effect, meaning it can apply to non-US companies listed on American exchanges."

"primary legislation"

A law enacted directly by a legislature, forming the highest level of the legal hierarchy

"The UK Bribery Act is primary legislation that sets out the criminal offences for both private individuals and corporations."

"secondary legislation"

Rules and regulations made under powers granted by primary legislation, which provide detailed operational requirements

"The secondary legislation implementing the EU's Fifth Anti-Money Laundering Directive required member states to establish public beneficial ownership registers."

"suspicious activity report"

A formal report filed with a financial intelligence unit when a firm suspects that funds may be linked to criminal activity

"The compliance officer filed a suspicious activity report after identifying a series of structured cash deposits that appeared designed to evade reporting thresholds."

"placement, layering, integration"

The three classic stages of money laundering: introducing illicit funds, obscuring their trail, and reintroducing them as legitimate assets

"The forensic accountant traced the fraud through all three stages — placement, layering, integration — before presenting findings to the prosecutor."

"beneficial owner"

The natural person who ultimately owns or controls a legal entity or arrangement, even if their name does not appear on official records

"The compliance team could not onboard the corporate client until it had verified the identity of the beneficial owner holding more than 25% of the shares."

"transaction monitoring"

The automated or manual review of customer transactions to identify patterns that may indicate financial crime

"The bank's transaction monitoring system flagged 300 alerts in the first week after the new rules for high-value cash transactions were applied."

"structuring"

The deliberate breaking up of large cash transactions into smaller amounts to avoid regulatory reporting thresholds, also called smurfing

"The defendant was convicted of structuring after making nine deposits of $9,900 each over two weeks to stay under the $10,000 currency transaction reporting limit."

"de-risking"

The practice by financial institutions of exiting relationships with entire categories of clients perceived as high risk rather than managing individual risk

"Critics argued that the bank's de-risking policy had cut off legitimate remittance services and left migrant workers without access to affordable financial products."

"financial intelligence unit"

A national body that receives, analyses, and disseminates financial disclosures to law enforcement agencies to combat money laundering

"The financial intelligence unit shared its analysis of suspicious property transactions with the national police anti-corruption team."

"predicate offence"

An underlying crime — such as fraud, drug trafficking, or bribery — that generates the proceeds that are then laundered

"To secure a money laundering conviction, the prosecution must prove that the funds derived from a predicate offence."

"know your customer"

The process of verifying the identity of a customer and assessing the risks associated with the business relationship before onboarding

"The know your customer process required the client to submit two forms of government-issued identification and proof of address."

"enhanced due diligence"

A higher level of scrutiny applied to customers who present greater money laundering or compliance risk, such as politically exposed persons

"The relationship manager triggered enhanced due diligence when the client indicated that her father was a senior government minister."

"simplified due diligence"

A reduced level of customer verification permitted for clients assessed as low risk, such as listed companies or public bodies

"The compliance policy allowed simplified due diligence for institutional pension funds, which are subject to their own regulatory oversight."

"politically exposed person"

An individual who holds or has held a prominent public function, or is a close associate or family member of such a person, who may pose a higher corruption risk

"All new accounts for politically exposed persons were automatically escalated to senior management for approval before opening."

"customer risk rating"

A score assigned to a client based on factors such as jurisdiction, product type, and customer profile that determines the level of ongoing monitoring required

"The customer risk rating was reviewed annually and could be upgraded or downgraded based on changes in the client's business activity."

"ongoing monitoring"

The continuous review of a customer relationship, including transaction activity and changes in circumstances, throughout the life of the account

"Ongoing monitoring of the import-export business revealed a significant increase in wire transfers to high-risk jurisdictions that had not been flagged at onboarding."

"source of funds"

The origin of the specific money used in a transaction or financial relationship, which must be identified for higher-risk customers

"The private bank required the client to provide documentation confirming the source of funds before accepting the initial deposit of $5 million."

"source of wealth"

An explanation of how a customer accumulated their overall net worth, required for high-net-worth and politically exposed person relationships

"The compliance team requested a detailed source of wealth declaration, including evidence of the business sale proceeds cited by the client."

"designated person"

An individual or entity listed on a government sanctions list whose assets must be frozen and with whom dealings are prohibited

"The payment was blocked automatically after the beneficiary name matched a designated person on the OFAC Specially Designated Nationals list."

"asset freeze"

A legal prohibition that prevents a sanctioned party from moving, transferring, or otherwise dealing with their assets

"The asset freeze on the oligarch's accounts meant the bank could neither return funds nor allow any transactions to proceed."

"false positive"

A sanctions screening alert generated against a name that matches a watchlist entry but turns out to be an unrelated person or entity

"Over 90% of the firm's daily screening alerts were false positives, placing a heavy burden on the compliance team to investigate and clear each one."

"ownership and control test"

The analysis used to determine whether an entity is subject to sanctions because it is owned (50% or more) or controlled by a designated person

"The compliance analyst applied the ownership and control test to determine that the target company was majority-owned by a sanctioned individual."

"sectoral sanctions"

Restrictions that target specific economic sectors — such as energy, finance, or defence — of a particular country rather than named individuals

"Sectoral sanctions on Russia's financial sector prohibited US persons from dealing in certain types of debt or equity instruments issued by major Russian banks."

"deconfliction"

The process of resolving a screening alert by confirming that a matched party is not the sanctioned individual and documenting the decision

"The compliance officer completed a deconfliction memo showing that the matched name belonged to a retired schoolteacher with no connection to the listed arms dealer."

"wind-down licence"

A temporary authorisation granted by a sanctions authority permitting a firm to complete or close out existing contractual obligations with a newly designated party

"OFAC issued a wind-down licence giving the company 45 days to complete and settle the pre-existing energy supply contract before full sanctions took effect."

"correspondent banking"

A relationship in which one bank provides services to another, creating risk that transactions involving sanctioned or high-risk parties may pass undetected

"The correspondent banking relationship was terminated after the partner bank's weak sanctions screening allowed several transactions linked to a designated entity to pass through."

"three lines of defence"

A risk management model in which the first line (business units), second line (compliance and risk), and third line (internal audit) each play distinct roles in managing risk

"Under the three lines of defence model, the compliance function sits in the second line and provides independent oversight of the business units."

"tone at the top"

The ethical culture and attitude toward compliance set by senior leadership, which cascades throughout the organisation

"The new CEO's public commitment to integrity and her dismissal of a senior executive for a minor breach sent a powerful tone at the top message to all staff."

"speak up culture"

An organisational environment in which employees feel safe to raise concerns about misconduct or potential compliance breaches without fear of retaliation

"The annual ethics survey showed that 85% of employees believed the company had a genuine speak up culture where concerns would be taken seriously."

"facilitation payment"

A small unofficial payment made to a government official to speed up a routine action that the official is already obligated to perform; illegal under many anti-bribery laws

"The company's code of conduct prohibited facilitation payments in all jurisdictions, even where local custom might treat them as acceptable."

"conflicts of interest policy"

A written policy requiring employees to identify and manage situations where personal interests may improperly influence business decisions

"Under the conflicts of interest policy, all employees were required to disclose any personal relationship with a vendor or client they were involved in evaluating."

"adequate procedures"

Under the UK Bribery Act, the defence available to a commercial organisation that can demonstrate it had proportionate anti-bribery procedures in place

"The company successfully argued the adequate procedures defence by presenting its training records, risk assessments, and supplier due diligence documentation."

"whistleblower protection"

Legal safeguards that prevent retaliation against employees who report suspected wrongdoing in good faith to regulators or internal channels

"The EU Whistleblower Protection Directive requires companies with 50 or more employees to establish secure internal reporting channels with guaranteed whistleblower protection."

"compliance programme effectiveness"

An assessment of whether a compliance programme actually prevents and detects violations, typically evaluated by regulators when determining penalties

"The Department of Justice applied a reduced penalty because an independent review confirmed the company's compliance programme effectiveness before the misconduct occurred."

"lawful basis for processing"

One of the six legal grounds under GDPR that an organisation must rely on when processing personal data, such as consent, contract, or legitimate interest

"The marketing team had to identify a lawful basis for processing before launching the new email campaign targeting existing customers."

"data subject rights"

The rights granted to individuals under GDPR including the right of access, rectification, erasure, portability, and objection

"The privacy team created a standard procedure for handling data subject rights requests within the mandatory 30-day response period."

"data protection impact assessment"

A process required under GDPR for evaluating and mitigating privacy risks before carrying out processing activities that are likely to result in high risk to individuals

"The IT department completed a data protection impact assessment before deploying the new employee productivity monitoring software."

"personal data breach"

A security incident that results in the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to personal data

"The company notified the supervisory authority of the personal data breach within 48 hours of discovering that customer email addresses had been exposed."

"data minimisation"

The GDPR principle requiring that only the personal data strictly necessary for the specified purpose should be collected and processed

"During the privacy audit, the consultant recommended applying data minimisation by removing the nationality field from the registration form as it served no legitimate purpose."

"regulatory return"

A formal report submitted to a regulator on a periodic basis containing financial, risk, or compliance data required by law or regulation

"The compliance analyst prepared the quarterly regulatory return for submission to the Prudential Regulation Authority before the filing deadline."

"material breach"

A significant violation of a regulatory requirement or contractual obligation that may trigger penalties, reporting obligations, or termination rights

"The failure to submit the annual compliance certification on time was classified as a material breach under the firm's regulatory capital agreement."

"self-reporting"

The voluntary disclosure by an organisation to a regulator of a compliance failure or violation discovered through its own internal processes

"The company's decision to engage in self-reporting before any regulator investigation was identified as a significant mitigating factor in the penalty calculation."